PT-2026-51147 · Cap Go · Cap-Go

Judel777 · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56227

Mitre

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these addresses with error responses disclosed to users.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-56227

Affected Products

Cap-Go

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56227 · Security Note
• https://github.com/Cap-go/capgo/security/advisories/GHSA-48hc-53hv-6x3f · Vendor Advisory
• https://vulncheck.com/advisories/capgo-server-side-request-forgery-via-webhook-url-validation · Note